Skip to content

Fixed security risk and redundant quote #440

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
frankgiordano merged 9 commits into from
Dec 25, 2025
Merged

Fixed security risk and redundant quote #440

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
7a84260
Fixed security risk and redundant quote
shabaz213 Dec 24, 2025
1cf268a
Removed redundant single quote
shabaz213 Dec 24, 2025
8c3e1d3
Made setUser method package-private
shabaz213 Dec 24, 2025
58a1206
Normalize zOSMF basePath in url
shabaz213 Dec 24, 2025
f4ef5db
Normalize zOSMF basePath in url
shabaz213 Dec 24, 2025
e35347c
Removed redundant isUrlNotValid method
shabaz213 Dec 24, 2025
e83945c
Replace backward slash with forward slash in baseUrl
shabaz213 Dec 25, 2025
2a982a8
Added back isUrlNotValid method
shabaz213 Dec 25, 2025
0d2e0c8
Renamed unit test for clarity
shabaz213 Dec 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion src/main/java/zowe/client/sdk/core/ZosConnection.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -218,7 +218,8 @@ void setBasePath(String basePath) {
}

private String getNormalizedPath(String basePath) {

@frankgiordano frankgiordano Dec 25, 2025 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about change this method as follows:

/**
 * Normalizes a path by collapsing multiple slashes, resolving relative segments (. and ..),  
 * and ensuring a consistent leading slash. The result is standardized to forward slashes   
 * and excludes a trailing slash unless it is the root path.  
 * 
 * @param basePath The raw path string to normalize.
 * @return A canonical Unix-style path string.
 */
private String getNormalizedPath(String basePath) {
    // Paths.get handles leading slashes and collapses internal duplicate slashes
    // normalize() resolves dot-segments like /./ and /../
    final String normalized = Paths.get("/", basePath).normalize().toString().replace("\\", "/");
    
    // Remove trailing slash unless the result is the root "/"
    return (normalized.length() > 1 && normalized.endsWith("/"))
            ? normalized.substring(0, normalized.length() - 1) : normalized;
}

@shabaz213 shabaz213 Dec 25, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can replace all the backward slashes with forward slash in the same logic, but I don't think its a good idea to use "Paths" class as it will interpret "file separator" differently based on OS, for windows and Unix it will be different.

@shabaz213 shabaz213 Dec 25, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pushed a new commit to replace backward slashes to forward slashes

@frankgiordano frankgiordano Dec 25, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok thanks.. with your updated version and without using Path how about we change the method to be like this way:

/**
 * Normalizes a path string by standardizing separators, collapsing multiple 
 * consecutive slashes, and ensuring a consistent leading slash.
 * <p>
 * This method performs the following transformations:
 * <ul>
 *   <li>Converts all backslashes (\) to forward slashes (/).</li>
 *   <li>Collapses multiple consecutive forward slashes into a single slash.</li>
 *   <li>Ensures the path begins with a leading slash.</li>
 *   <li>Removes the trailing slash unless the path is the root "/".</li>
 * </ul>
 *
 * @param basePath raw path string to be normalized.
 * @return canonicalize path string, or "/" if the input is null or blank.
 */
private String getNormalizedPath(String basePath) {
    // standardize separators and ensure a leading slash
    String normalizedPath = basePath.replace('\\', '/');
    normalizedPath = normalizedPath.startsWith("/") ? normalizedPath : "/" + normalizedPath;
    
    // collapse two or more consecutive slashes into one
    normalizedPath = normalizedPath.replaceAll("/{2,}", "/");

    // remove trailing slash unless the result is just the root "/"
    if (normalizedPath.length() > 1 && normalizedPath.endsWith("/")) {
        normalizedPath = normalizedPath.substring(0, normalizedPath.length() - 1);
    }

    return normalizedPath;
}

@frankgiordano frankgiordano Dec 25, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actually lets change the beginning to this to handle spaces too:
// remove all spaces and standardize separators and ensure a leading slash
String path = basePath.replace(" ", "").replace('\', '/');

String normalizedPath = basePath.startsWith("/") ? basePath : "/" + basePath;
String normalizedPath = basePath.replace('\\', '/');

@frankgiordano frankgiordano Dec 25, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we do the following here:
String normalizedPath = basePath.replace(" ", "").replace('', '/');

@frankgiordano frankgiordano Dec 25, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I meant to say:
String normalizedPath = basePath.replace(" ", "").replace('\', '/');

normalizedPath = normalizedPath.startsWith("/") ? normalizedPath : "/" + normalizedPath;
return normalizedPath.endsWith("/") ?
normalizedPath.substring(0, normalizedPath.length() - 1) : normalizedPath;
}
Expand Down
3 changes: 3 additions & 0 deletions src/test/java/zowe/client/sdk/core/ZosConnectionFactoryTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,11 +208,14 @@ public void tstZosConnectionFactoryBasePathHashCodeMapWithSamePathsSuccess() {
"test", "zosmfPort", "user", "password", "custom/path/");
final ZosConnection zc4 = ZosConnectionFactory.createBasicConnection(
"test", "zosmfPort", "user", "password", "custom/path");
final ZosConnection zc5 = ZosConnectionFactory.createBasicConnection(
"test", "zosmfPort", "user", "password", "\\custom\\path");
final var zcs = new HashMap<ZosConnection, Integer>();
zcs.put(zc1, 1);
zcs.put(zc2, 2);
zcs.put(zc3, 3);
zcs.put(zc4, 4);
zcs.put(zc5, 5);
assertEquals(1, zcs.size());
}

Expand Down